What are the actual risks of vulnerabilities caused by deviations?

[Subway2023]

Component

sp1-zkvm

Describe the feature you would like

What are the actual risks of vulnerabilities caused by deviations (such as execution results being inconsistent with expectations, shown in bug)?
What impact could this have on zk-rollups or blockchain?

Additional context

No response

[themighty1]

The risks are a complete loss of soundness. But to exploit it, the attacker has to use unsafe {} iiuc.
To mitigate, we can pin the dependencies to prevent supply-chain attacks + audit the guest program code.